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Intellectual Property Rights 



IPRs essential or potentially essential to the present document may have been declared to ETSI. The information 
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found 
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in 
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web 
server ( http://webapp.etsi.org/IPR/home.asp) . 

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee 
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web 
server) which are, or may be, or may become, essential to the present document. 



Foreword 

This Technical Specification (TS) has been produced by ETSI Technical Conmiittee Lawful Interception (LI). 

The present document is part 6 of a multi-part deliverable. Full details of the entire series can be found in 
TS 102 232 parti [2]. 



Introduction 



The TS 102 232 series of standards aims to provide a common delivery interface for lawfully-intercepted material from 
a wide range of services. The aim of the present document is to increase the range of services to which the TS 102 232 
interface applies, by including services from 3GPP TS 33.108 [3] within the TS 102 232 delivery framework. 
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Scope 



The present document specifies an approach for the handover of the lawfully-intercepted information that is defined in 
3GPPP TS 33.108 [3]. The present document uses the handover techniques defined in TS 102 232-1 [2]. In this way, the 
present document allows additional services to be delivered through a common interface. 

Specifically, the scope of the present document includes the handover of lawfully-intercepted information from the 
following parts of 3GPP TS 33.108 [3]: 

• IRI from the mobile circuit- switched domain (3GPP TS 33.108 [3] clause 5) . CC from the mobile circuit- 
switched domain is not covered by the present document. 

• IRI and CC from the mobile packet-switched domain (3GPP TS 33.108 [3] clause 6). 

• IRI and CC from the multi-media domain (3GPP TS 33.108 [3] clause 7). 

The present document does not override or supersede any specifications or requirements in 3GPP TS 33.108 [3]. 



References 



References are either specific (identified by date of publication and/or edition number or version number) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• Non-specific reference may be made only to a complete document or a part thereof and only in the following 
cases: 

if it is accepted that it will be possible to use all future changes of the referenced document for the 
purposes of the referring document; 

for informative references. 

Referenced documents which are not found to be publicly available in the expected location might be found at 
http://docbox.etsi.org/Reference . 

For online referenced documents, information sufficient to identify and locate the source shall be provided. Preferably, 
the primary source of the referenced document should be cited, in order to ensure traceability. Furthermore, the 
reference should, as far as possible, remain valid for the expected life of the document. The reference shall include the 
method of access to the referenced document and the full network address, with the same punctuation and use of upper 
case and lower case letters. 

NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee 
their long term validity. 

2.1 Normative references 

The following referenced documents are indispensable for the application of the present document. For dated 
references, only the edition cited applies. For non-specific references, the latest edition of the referenced document 
(including any amendments) applies. 

[1] ETSI TS 101 671: "Lawful Interception (LI); Handover interface for the lawful interception of 

telecommunications traffic". 

NOTE: Periodically TS 101 671 is published as ES 201 671. A reference to the latest version of the TS as above 
reflects the latest stable content from ETSI/TC LI. 

[2] ETSI TS 102 232-1: "Lawful Interception (LI); Handover Interface and Service-Specific 

Details (SSD) for IP delivery; Part 1: Handover specification for IP delivery". 
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[3] ETSI TS 133 108: "Universal Mobile Telecommunications System (UMTS); 3G security; 

Handover interface for Lawful Interception (LI)" (3GPP TS 33.108). 

2.2 Informative references 

Not applicable. 



3 Definitions and abbreviations 

3.1 Definitions 

For the purposes of the present document, the terms and definitions given in TS 102 232-1 [2] and TS 101 671 [1] 
apply. 

3.2 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 

ASN. 1 Abstract Syntax Notation One 

CC Content of Communication 

CIN Communications Identity Number 

CSP Communications Service Provider 

NOTE: CSP covers all Access Providers, Network Operators and Service Providers. 

IP Internet Protocol 

IRI Intercept Related Information 

LEMF Law Enforcement Monitoring Facility 

LI Lawful Interception 

MF Mediation Function (at CSP) 

PDU Protocol Data Unit 

PS Packet Switched 

uLIC UMTS LI Correclation 

UMTS Universal Mobile Telecommunication System 



4 General 

4.1 Approach 

The present document forms part 7 of the TS 102 232 family of standards, in that it is a service-specific component of 
the TS 102 232-1 [2] framework. 

3GPP TS 33.108 [3] defines the interception behaviour that leads to IRI events on the handover interface, for both the 
packet data domain and circuit switched domain. 
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4.2 



Reference model 




Mediation 
Function (MF) 



Handover 
interface 



Law Enforcement 

Monitoring 
Facility (LEMF) 



Figure 1 : Reference model 



Headers, data exchange and networks 



5.1 Approach 



TS 102 232-1 [2] describes a technique for data exchange, and specifies the headers that shall be associated with the 
results of interception. The present document follows TS 102 232-1 [2] regarding headers, data exchange and networks 
demonstrates how the header fields in TS 102 232-1 [2] can be populated in a direct and straightforward manner using 
the interception information available in 3GPP TS 33.108 [3]. 



5.2 



Structures 



IRI events from 3GPP TS 33.108 [3], for both circuit and packet switched services, are sent using the uMTSIRI element 
oflRIContents. 

CC from packet switched services are sent using the uMTSCC element CCContents, which is an OCTET STRING. 



Intercept Related Information (IRI) and Content of 
Communication (CC) 



6.1 



Definition of IRI events and CC 



IRI events are defined as per 3GPP TS 33.108 [3]. 



6.2 



IRI format 



IRI events are defined as per 3GPP TS 33.108 [3] for both circuit and packet switched services. They are sent using the 
uMTSIRI element oflRIContents. 

Fields which are duplicated in the 3GPP TS 33.108 [3] and TS 102 232-1 [2] structures should be populated 
consistently in both structures. Annex A.l gives guidance on mapping between 3GPP TS 33.108 [3] elements and 
TS 102 232-1 [2] elements for IRI. 
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6.3 CC format 



CC from packet switched services are sent using the uMTSCC element CCContents, which is an OCTET STRING. The 
OCTET STRING will be as defined in the payload element of the CC-PDU structure in 3GPP TS 33.108 [3] clause B.4. 

The information in the uLIC -header element of CC-PDU will be used to populate the header information in the 
LI-PS-PDU structure of TS 102 232-1 [2]. Clause A.l gives guidance on the mapping between these elements. 
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Annex A (normative): 
ASN.1 forlRlandCC 

A.1 Note on integrating ASN.1 structures 
A.1.1 Header field mappings 

Table A.l shows how elements of the TS 102 232-1 [2] PSHeader structure should be populated from information in 
the 3GPP TS 33.108 [3] IRI-Parameters structure. 

Table A.1 : 3GPP TS 33.108 [3] to TS 102 232-1 [2] PSHeader mapping 



TS 102 232-1 PSHeader element 


Source from 3GPP TS 33.108 


lawfullnterceptionldentifier 


Copied directly from IRI-Parameters. lawfullnterceptionldentifier 


autiiorizationCountryCode 


Supplied directly by the MF 


communicationldentifier 


See below for individual elements 


networkldentifier 


See below for individual elements 


operatorldentifier 


Copied directly from IRI-Parameters. networkldentifier.operatorldentifier 


eTSI671NEID 


Copied directly from IRI-Parameters. networkldentifier.Network-Element- 
Identifier 


communicationldentityNumber 


See clause A.1. 2 


deliveryCountryCode 


Supplied directly by the MF 


sequenceNumber 


Supplied directly by the MF 


timeStamp 


Copied from IRI-Parameters.timeStamp. 

This requires a conversion from HI20perations. TimeStamp to GeneralizedTime 



Table A.2 shows how elements of the TS 102 232-1 [2] IRIPayload structure should be populated from information in 
the 3GPP TS 33.108 [3] structures. 

Table A.2: 3GPP TS 33.108 [3] to TS 102 232-1 [2] IRIPayload mapping 



TS 102 232-1 IRIPayload element 


Source from 3GPP TS 33.108 


iRIType 


Inferred from UMTSIriContent 


timeStamp 


Copied from IRI-Parameters.timeStamp (assuming no aggregation of PDUs) 
This requires a conversion from HI20perations. TimeStamp to GeneralizedTime 


iRIContents 


See below for individual elements 


uMTSIRI 


See below for individual elements 


iRI-Parameters 


Copied directly from IRI-Parameters, if handing over packet domain IRI 


iRI-CS-Parameters 


Copied directly from IRI-Parameters, if handing over circuit switched IRI 



Table A.3 shows how elements of the TS 102 232-1 [2] PSHeader structure should be populated from information in 
the 3GPP TS 33.108 [3] CC-PDU structure. 

Table A.3: 3GPP TS 33.108 [3] to TS 102 232-1 [2] PSHeader mapping 



TS 102 232-1 [2] PSHeader element 


Source from 3GPP TS 33.108 


lawfullnterceptionldentifier 


Copied from CC-PDU. uLIC-header.lllD 


authorizationCountryCode 


Supplied directly by the MF. 


communicationldentifier 


See below for individual elements 


networkldentifier 


See below for individual elements 


operatorldentifier 


Supplied directly by the MF (see 3GPP TS 33.108 [2] clause 5.2.4) 


eTSI671NEID 


Supplied directly by the MF (see 3GPP TS 33.108 [2] clause 5.2.4) 


communicationldentityNumber 


See clause A.1. 2 


deliveryCountryCode 


Supplied directly by the MF 


sequenceNumber 


Supplied directly by the MF 


timeStamp 


Copied from CC-PDU. uLIC-header.timeStamp 

This requires a conversion from HI20perations. TimeStamp to GeneralizedTime 
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Table A.4 shows how elements of the TS 102 232-1 [2] CCPayload structure should be populated from information in 
the 3GPP TS 33.108 [3] structures 

Table A.4: 3GPP TS 33.108 [3] to TS 102 232-1 [2] CCPayload mapping 



TS 102 232-1 CCPayload element 


Source from 3GPP TS 33.108 


payloadDirection 


Copied from GG-PDU.uLIC-header.t-PDU-direction 

This requires a trivial translation between TPDU-direction and PayloadDirection 

enumerated types 


timeStamp 


Copied from CC-PDU.uLIC-header.timeStamp 

This requires a conversion from HI20perations. TimeStamp to GeneralizedTime 


ccContents 


See below for individual elements 


uMTSCC 


Bytes copied from CC-PDU.payload 



A.1.2 GIN allocation 

CIN allocation follows TS 102 232-1 [2] clause 5.2.4. The CIN extension field may be used, if required, using the 
CorrelationValues field as described in 3GPP TS 33.108 [3]. 
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Annex B (informative): 
Change request history 
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Rapporteur of the present document is Chris White (GTEN) 
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